REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 Docket No. 50325-1085 




REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl.No.: 10/661,224 Docket No. 50325-1085 




REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl.No.: 10/661,224 Docket No. 50325-1085 




REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 Docket No. 50325-1085 


Security Perimeter Details - Microsoft Internet Explorer — ] 3 


X 


"I 




7:75:09 PM PDT :: Close 




a 


1 


Security Perimeter Details 
^Jame:[7 Change 




Cloud-3 


JSRbr-fW-1 

D^- 10.15.234 / 

^ z=^n-lOA.1.0/24 

\n-WX5.0/24 / 

n t=p7 TTT 3 Qbr-sW-1 

Branch-hostl / ' — < 

/ ^^n-10.5X.0/24 

H-10X.5.30 ® 

BR-Heod-End-Rou ter 


H 


i ,, *» 


a 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 ~ Docket No. 50325-1085 




REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 Docket No. 50325-1085 



O 

CD 



CO 
I — 
Cd 
O 
O— 



>- 



o 



CO 



CO 



Crr: 
o 



o 
o 

LU 
I — 

o 
Q_ 



co 



"o 



lO 

Zn 

lO 

to 

CN 



a> 

CO 



o 
_s=; 
CO 



-a 



o 
o 



E 
-o 

o 

D 



o 

JO 



CO 



I I 



o 

CO 



m 

c 
o 



o 

CD 



CD 

o 
c_> 
=J 
CO 



o 

^C_J> 



>- 

CD 

o 

i 

o 



on 



o 



u o 

-p; CO 

o a) 

■? a 



>- 



>- 



Q_ CD 
i — O- 

cd cd 

^5 HI 
cd^cd" 



cd S 



Cl 



5^ "5 °° 



CN fO 



„ CD 



5 W 



CD CD 
- >- 
CD CD 

CD CD 

3 5 



DOOO 



r* CD CD 



com 

CD CD 



o o o o o 

"CD ~CD ~CD CD "a? 



i CD CD 



>- 



CD 

-< 



cd rrr 



cd 



o .cj 

Q- >■ 
CD CD 

ca cd 



o 

P--4 



CD 
CN 
CD 
LCD 
OO 
CO 



Q_ 



CO cj 



a 
o 

El 



_ BH 

It 



XXXH 



cd 



cdjs^ 
cd o_ 

CN 



(A 



CD 



cn ci5 

CN 



IS 

CD 



CO 
CO 



S3 



CD 
CD' 



CD 
lO D_ 



-t- 
J= 



tti ci 
CD 

co j= 



CO 



OO 
CD 



CD 
CD 
m 
CN 



S3 
to 

CN 



CD 
-=t- 
CD" 



^to 

CN^iJ 

Tina. 



a. 

CJ) 



© — a 

Li_ Lj_ CI 

-£ a? CD 



• co- 



55 lh= 



CN CD 



CD 



£3 

CN 
CN 
CD" 



CD 
CD 
CD 
CN 



S3 

CD 



CO 



CJ) 



52 o 



CN • 
CD i 
CD- 1 



13 

S3 



CO CD 



CO 
CN 

lO ' 
CD 



io cn 

s ^ 

OD CD 
cp lO 

r~- co 
co co 
co « 



to 



I I 



cTQ 
i — ."P <= 

CD J=- O 
CN\ CD 

Ot; c 
^2-5 § 



CO CN 
CD CD 
CO LO 

t~r co 

CO to 

Cn 



o 

JO 



O 
JO 



O - 

a> 



co 
k — 
o 

O- 

ad. 



CD 
Gf 



CD 



TO 



E 

co 



o 



CD 

CD 

CD 

~o 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 Docket No. 50325-1085 




ion 












o 
.2 1 
























False 
Positive 




Tune 


Tune 


Tune 


Tune 


Groph 




31 


31 


31 


31 


Reporting 
Devices 




du 

,Q 


CO 


ZU. CO-J- 

1 1 1 "CO 
OOOq 

3: :c 3z « 


3 
i 


Zone 




CA 


CA 


CA 


CA 




CN 

~o 


try cp 
CD~-=. 
-CN 


i — 

t-O 

CD a- 

_CN 
-«H- 


1, 2003 
42 PU 


CD D_ 
-■«*• 


Time 


"5 
i — 

ED 


Jul 2' 
5: 26: ^ 


Jul 2 
5:26:' 


Jul 2 
5:26: 
PDT 


Jul 2 
5:26: 
PDT 


Protocol 




Q_ 
ZS- 
CJ> 


o 


O 


o 










CL. 


CD V- |" Xfi 

gift s 

a: 

-8 "o.jG-^ 

^r"o a. aj 
CN a 


o 
Q_ 




o 


o 


B + 

O CD 
CD-i^ 
x - „ 
LU 11 

oo x: 


Destination IP/ 


192.168.1.100 


192.168.1.100 


192.168.1.100 


13 

cd 

od 
to 

CN 


Q 
•<*■ 

CN 

CN j 
CD 

cd 
ro 






o 


CD 


2500 


CD 
CD 
CD 
CN 


IP/Port 


Q 

CN 


Q 

l-O 
CN 


Q 
to 

CN 


Q 

CN 


s 

CD 
CO 


Source 


40.40.1 


40.40.' 


40.40.' 


40.40. 


192.16 




o_ 
a> 

CD 
CO 
^£ 

o 

CD 


o_ 

CD 
CD 

CO 

o 

CD 


NetWork Sweep 


"O <- 

-. CD 

CO O 
« CD 


o_ 

1 1 

TD 
CD 

'1 

CD 
Q_ 

. ,"P c 

IS--I 

CD — £ 

^2 3 g 

.^.nn ci 


Events 


<_5 

oF 
o o 


a. 

'oF 
o o 


CL. 

CD o 


o 

^^*>- 

"=^,00 

] ^ ^ 

lO "x 
CD CD 
cn "o 
: -r— ^ c= 


3 

> £ 

h o a. 

'55 
■* en c. 

: » c 

J CO i— 


i 
i 

> 
> 

■ 


S: 676852 
1:6850290 


S: 676853 
,1:6850290 


S: 676903 
1:6850290 


S: 676984 
1:6850290 


fset 












H O 










-a- 



to 
o 

CD_ 



CD 
=3 

a 



o 
£ 
E 

CO 



o 

Q_ 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 Docket No. 50325-1085 



jjp| Security Device Information - Microsoft Explorer Explorer Q| 


silk 


i 


PROTEGO NETWORKS 


6 


f loain: Administrator, Administrator (pnadmin) :: July 21, 2003 6:11:16 PM 

PDT :: | Close 


Security Device Information 

Name: HQ-Web-1 

Device type: Entercept Entercept 2.5 

IP Address: 192.168.1.10 None/not found. 

Zone: CA 

Managed by: mars200[Tl 

Status: Active 

Default gateway: 0.0.0.0 


Proteao Networks. Inc. I Feedback 



FIG. 9 



ip] Security Device Information - Microsoft Explorer Explorer [ 


-II 


□ 


|j_> 




PROTEGO NETWORKS 


B 


login: Administrator, Administrator (pnadmin) :: July 21, 2003 € 

PDT : 


:09:48 PM 


: | Close 


Security Device Information 

Name: HQ-FW-1 

Device type: Cisco PIX 6.2 

IP Address: 192.168.1.10 None/not found. 

172.30.1.10 None/not found 
10.33.10.2 None/not found 

Zone: CA 

Managed by: mars200|±) 

Status: Active 

Default gateway: 172.30.1.1 


Protego Networks, Inc. 


Feedback 







FIG. 10 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 Docket No. 50325-1085 




CD 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 Docket No. 50325-1085 



ip| Incident Graph - 685029 - Microsoft Internet Explorer 



PROTEGO NETWORKS 



login: Administrator, Admin 



Incident Graph - 685029 



Session ID: 676852 E 



Src: 40.40.1.23/0 
Dest: 192.168.1.10/0 
Event Types: 

ICMP Network Sweep 
W/ Echo 



Previous 



Next 



30.30.2.24 



Gateway 54 



n-212.31.100.0/24 




40.40.1.23 



© HQ-WAN-Edge-Router 



I 



n-1 00.1. 20.0/24e^=» 

@|hq-sW-i 

m-1 72.30.1. 0/24 

Ihq-fW-1 



n-1 72.30.2.0/24 




HQ-Web-1 @ 



n-192.168.1.0/24 



n-10.33.1 0.0/24 



FIG. 11B 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl.No.: 10/661,224 Docket No. 50325-1085 




REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 Docket No. 50325-1085 



i — 
an 



CO 

o 

CN 



_o 



CD 



E 
jo 

o 



o 
m 
O 



O 

S3 



CO 
O 



o 
o 

LU 
I — 

o 
□_ 









t 

o 




ICMP 




ICMP 




CD 




O 








,168, 




CN 
CO 




A 
l 


Raw Message 


40.40.1.23/0 - 
Sweep w/Echo 




CN 




to 

CN 




iK 




21, 2003 
PDT 


£ 


32 



t_ <D 
o .y 
o_ >- 



o 



to Q 



c 72 
a> o 



oo 



I 

C3 



r-o i-o cr> 
lO iO CN 
CO OO c3 
CO cp to 

r-- i oo 

CD CD (O 
UJ OO . 



o 

CD 
CO 



s 

CD 



cz 



CO 
c 

o 
-t— * 

CD 

O 
cn 
CD 

O 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 Docket No. 50325-1085 



Incident Graph - 685029 - Microsoft Explorer 



PROTEGO NETWORKS 



Incident Groph - 685029 



Session ID: 676853 M 



Src: 40.40.1.23/0 
^ Dest: 192.168.1.10/0 
Event Types: 

ICMP NetWork Sweep 
W/ Echo 



Previous Next 



n-212.31. 100.0/24 




30.30.2.24 

Gateway 54 

40.40.1.23 



I 



@ HQ-WAN-Edge-Router 



n-100.1.20.0/24=j=" 

©Ihq-sW-1 



n-1 72.30.2.0/24 




HQ-Web-1 @ 



n-192.168.1.0/24 



n-1 72.30.1.0/24 



n-1 0.33.1 0.0/24 



FIG. 12B 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl.No.: 10/661,224 Docket No. 50325-1085 




REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 Docket No. 50325-1085 




52 

CD 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl.No.: 10/661,224 ' Docket No. 50325-1085 



Q Incident Graph - 685029 - Microsoft Explorer 



an 



PROTEGO NETWORKS 



Incident Graph - 685029 



Session ID: 676903 E 



Src: 40.40.1.23/2500 
Dest: 192.168.1.10/80 
Event Types: 

WWW US .ida Indexing 
Service Overflow 



Previous Next 



30.30.2.24 



Gateway 54 



n-212.31.100.0/24 

® 

n-t00.1.20.0/24c=pi 




40.40.1.23 



HQ-WAN-Edge-Router 



n-1 72.30.2.0/24 

HQ-Web-l|@ 




©|hq-sW-i 

m-1 72.30.1.0/24 

Ihq-fW-1 



n-192.168.1.0/24 



n-10.33.10.0/24 



FIG. 13B 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 Docket No. 50325-1085 




REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl.No.: 10/661,224 Docket No. 50325-1085 



o 

I 



IB 



O 



o 







a. 


CD 




in 


CO 


o 


fO 




CO 




lO 




lO 




ro 

CD 


1 — 

cn 


CD 




CN 








cxi 








=3 









E 
"a 



o 



S3 



CO 

o 



o 
o 



o 

□_ 



CO 



CD 
> 




3 

u; 



o 
cz 



CO 

o 



o 

cn 

CD 

~o 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl.No.: 10/661,224 Docket No. 50325-1085 



Q Incident Graph - 685029 - Microsoft Explorer 



PROTEGO NETWORKS 



Incident Graph - 685029 
Session ID: 676984 

Src: 192.168.1.10/2000 
Dest: 30.30.2.24/21 
Event Types: 

Build/teardoWn/permitted IP 
connection 




30.30.2.24 
Gateway 54 

n-212.31.100.0/24 =£=i !LJi 40 - 40 - 1 - 23 

|©| HQ-WAN-Edge-Router 
n-1 00.1. 20.0/24 =|= 

Q| hq-sW-i 

n- 172.30.2.0/24=/ N= n - 172.30.1.0/24 

HQ-FW-1 




HQ-Web-1 @ 



n-1 92.1 68.1. 0/24 



10.33.10.0/24 



FIG. 14B 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 DocketNo. 50325-1085 




REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 Docket No. 50325-1085 



H 

II 

n 



CD 

_o 



O 
O 



1 

CD 
CD 
D 
Q_ 



O 

c_d 



o 



tn 

or 
o 



o 
o 



Q_ 



CD 



CD 
CD 



cn 

CD 
CD 
CN 



O 

o 



E 
■o 

o 

-* — ' 

o 



e 

-a 



en 



a 

-Q 
"CD 
CD 
CD 



CD 
CN 

CO 



CD 

to 

c 
o 



CD 
CP 

o 



c 
o 



to 
o 

D_ 

CD 
V) 



JO 
CO 

c_> 
o 

.c 

to 
o 
\— 
O 

"o 

"o 
a 

to 



CD 



O 
O 



°- E 
"* o 



c/> 



CD 

o E 
2 iJn 



to 
E 

CD 



c 



CD 



Q_ 

O 



to 
o 



o 



o 

c: 



to 

CD 



TP 
CD 



O 
if) 
CO 

s 9> 



>- 



a> 

CO 

o 

CD 
CN 



O 
to 
O 



co 



~ to D_ 



55. 

CO eg 
a> a. o 

O Q. 



c_> 
CO 

"S> 

TD 

E 

to 



o 
o 

CD 



CD 



o 

"CD 

c 



E 

CD 

n> 

CO 
cn 

2 

CD C 
O- CD 
O CO 



Q_ 

CD 
to 

o 

CD W 

-Q to 

CD 

■o 

CD 
C 

*E 

"CD t>- 

o O 
to ° 

CD O 

c 

CD *F 
to fc 
CD 

.2 

■*"* CD 

o to 
to £ 

J? «» 



CD 
O 

o 
CD 



C3 

EC 



CD 

c= 



CD 

CD 
cn 
CD 

~© 

I— 



cn 



- o - 

CD 



~T3 

CD 

OO 

So 
23 £ 



CO 

o 



o 
o 

UJ 

I — 

o 

Q_ 



CTTI 



co 
O 
Q_ 

CD 
00 



CO 



o 



CO 



CD 



"o 
c 



ft 



-a -a 
E E 



CD 

TD "-*-- 
CD CD_ 

-£Z "C 
CD CD 

cn 

O CD 
ISO 

¥C3 



is 

CO 
CD 
CD 
LCD 
CO 
CO 



CD 
TD 

*o 
cr 



CN ^ i — ■ 

r-D cj ro o lO o 

O O CD O CD O _ 
CT] CT> ^ CO ^ CT3 



O CD 
CO 

cn cd 



T3 

CD . 

CO^l 

m 



CN 1 1 

LO "S 
CD g 



-12 

CN c 
[£D LO 

to to 
Cn ^14 



rD~ 

CD 



CD 
CO 



CN3^CN 
r-O o O 
CD a CD a 
ai cn -p 



|co£d 

CD CO 

m cn 
CD g 

od y 



lO 

CD O 
cn 



CD 

cr> 

_CD 

"o 

Q_ 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl.No.: 10/661,224 Docket No. 50325-1085 




REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 Docket No. 50325-1085 



□ 



_o 



O 
tn 
O 



c 
o 



o 



CD 
_co 
o 



tn 

O 



o 
o 

LU 

I — 
O 
OH 
Q_ 



CO 

do 

o 

CD 



E 
o 



-a: 



E 
-a: 



o 



I I 

o 



o 

CN 



CO 



CD 



CD 
CO 



CD 
O 



o 



to 
o 

O 



o 



o 



CO 



o 1 



to 



E ~ 



© 
o 



(O 

o 
Q_ 

<u 

CO 



CD 



o 
o 



CD 

0 E 

1 «J Q. 



CO 

E 

to w 
c 

cn O 
e IS 
^= o 

p .y 



to 



JO 
CD 



O 
O 



CO 

o 



c: 
.o 

~o 

to 

CD 

■o 



CD 

o 

CD 
' 

CD 

E 

CD 

CO 
CD 



o 





o 




m* 




to 


>- 


i i i 












*o 




CO 




o 

t 


CD 




to 




O 




O 




O 
CN 


1—4 


CO 

* 


O 
OO 


o 




-o 


» 




Por 



O -a: o_ 



-2 -o 



o 
o 

CD 
\— 

CD 



E 

& 
to 

tE CD 
S 

CD C 

o to 



CD 
CO 



o 

E 
to 



=3 

o 



CD 

c 



T3 
CD 



O 
CD 



CD 
CD 
-O 

CO 

o 



CD 



CD 
O 



to 



CO 
CO 
CD 

crt 
O 
\_ 
D_ 

_CD 
Z3 



•o 

o <o 
— ' "o 



CO OJ 
, . crj 

o<N 



o 

en : 



E g 

— Q£ 



a. o 

O S= 



en 



CD 

cr> 



>- 



: o 
_.cj> 



>- 



cu- — 
o o 

§-<" 

C5 dc 



CD 
CD 



O 



Q_ 



o 

CD 



o 
o 



c 
o 
o 



o 

~CD 



o 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appf. No.: 10/661,224 Docket No. 50325-1085 



co 
c: 

CD 



LO 



CN 

i-o 

CD 

o 

CN 





CD 








c= 




_o 




'cn 




cn 




CL> 




CO 








o 








CO 



o 
cr> 
o 



"a 
o 



o 

■ . — . 
a 



-o 



o 



CO 



£=3 



a: 



CD 



CD _Q_ 

o o 
-t^ CO 

IS Q 

f £3 



>- 



H3 

co 

CD 
CD 
lO 

OO 
CO 



Mitigation 






Folse 
Positive 


Tune 




jz: 
a. 
o 

CD 


31 




Reporting 
Devices 


Q Ui_ CO 1 ^ 

!=1 1 1 1 
^ Of CT 




Zone 


CA 




Time 


CD-s- 

cn-5: 

r — 
^--co 

" — CD 
— CD 

^CN 




Protocol 


TCP 




Destination IP/Port 


+ 

3 dl 
o — > 
co 

OO .£= 




172.29.99.210 




Source IP/Port 


2509 




20.20.1.15 0 


H Total: 5 


Events 


LxJ 
1 

13 

O _c= 

lu tn co 

x P -S 

^ " 8 ^ 
o -s J S 

i— — — > 

O O !=| o . 


~d 

LU ^ « a. 
x a -a 

uxJ >j £ o 

<=> CD ^ CD 
h— ^. «e CO _, 

o ^ -=s= ^ o 

CO CO |^ CO 


[19032 5] 
Attack 0. 
[19032 6] 
Attack 0 
[1905114] 
Attack 01 
[1905124' 
Decode 0 


[1903215" 
Attack 0 
[1903216 
Attack E 
[1905081 
Access 0 
[1905115 
Attack 0 
[1905124 
Decode [T 


Session/ 
Incident ID 


S: 675271, 
1:6850080 




Offset 







a 
-o 



o 



E 

-a 



cn 
-t — 1 

\ 

o 
CD- 
cD 



cn 
a 



CD 



o 
E 
E 
:j 
co 



o 



























o 








2~ 








-4 ' 

<_> 








-=c 






1 — 




£ZS 




Q_ 








a_ 




cd 




LCD 




CD 




CN 




CN 




fO 




CD 




CD 




CN| 






















-♦— • 
















o 








cn 








o 














■ * 








*E 








O 




i — 




o_ 












o 








o 
















*E 




'e 








-<c 








o 




— ' 




a 












CO 




cz 




'e 








<c 




c£ 




'cn 




o 


CO 




CD 


CD 


~E5 




on 


c: 




_o 


Q. 


'to 


o 




Q 


> 


to 




_cu 






o 


Z3 


_o 




■<£ 


on 


go 

LiJ 




1 


o 


ZD 


CD 




Q. 




CO 




cz 


x> 


1 — 1 





=3 
CD 



CO 
CD 



O 



CO 



CD 
CP 



CD 



o 
to 

o « 

a> , 

35 ^ 
-o S? 



<u — 

CO 



cr>~c/-i 



»-T3 



-S 

•Sc"""" 
_d Cvi 

sS 

— Cv| 

o cvi 

CO I — 
O CD 



<2 to 

— ' "O 

O- o 
o * 

to -2 



>- 
-< 



>- 
■< 



Q- 

o 



o 



>- 



>- 
■<c 



>- 



cs 
cn 

°> -8 

^ I 

cs a. 

jCJ 



>- 



.-tr to 

CO j— 

o — -. 

Q_ 

<L> — ; 

to r~- 
o to 

-L CD 



>- 



CnI 

cn -- 

cn -3 
»J 1 
ON C 

^ C 
..CD 



>- 



cn 
to 

,°o 

■ "it 

> 

> •* — . 

> r— 
j to 

• CO 



l 

o. 

o _ 
to ce 



o 

CD 



o 
o 

-a 
cd 
cd 



o 



Q - 

cd 



c: 

*E 
-a 



CO 
O 



CD 



a> 

=3 

C3f 



cd 
E 

CD 

cn 
o 
c: 
a 



c: 



CD 



O 

E 



CO 



o 
to 



CD 



o 



o 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 Docket No. 50325-1085 



to 

CD 



to 
O 



CD 

in 



to 



CD 



Q_ 



o 

CM 
Cvl 

CM 

t~r> 

CD 

<o 

CM 



E 

O 



"e 

-a 



■o 



O 




9; 



CO 

o 



-o 
E 



o 

CJ> 



CD 
> 



CO 

o 
Q_ 

CD 
to 



o 
_cd 

CD 
CO 



Q_ 



o 

Q_ 



CM 



CJ) 



S3 



IS 
S3 



CN 

o 



is la la 
§§s 

Q CD O 
LO O lO 
lO DO 

->*- m id 
oo^o 

oOOO 

•w— lO lO OO 
-3" lO lO CO 



1313 

OO OO 

<=■ S 
o o 
lo <=2 

-r— LO 

~=t- lO 

SBkj 

^ CM 

ooo 
LO o o 
-* — LO lO 

•srioio 



CM 



o 



O 



CD- 
CD 



E 



CO 

o 



cd 
a; 



CD 

a 



E 
a> 
cn 
o 

T. 
O 



LiJ 



cd 

=3 



CD 
JO 



o 
E 
E 

CO 



CO 

o 



o 

s — 
Q_ 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl. No.: 10/661,224 Docket No. 50325-1085 




<5 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl.No.: 10/661,224 Docket No. 50325-1085 



0S? 
& 
I 



CD 

O 

Q_ 
X 



CD 
CD 



O 
in 
O 

CD 

3^ 



CO 



CO 
CD 

on 



CD 
Z3 



Q- 
<L> 



CD 



CD 



m 



D 



<2 



<3 
0 



o 
o 
m 

® 



C3 



-O 

CO 



cp 

Z3 



o 

CO 



o 

CD 
CO 



o 

CO 



to CO 

_ o 

u_ Cl_ 



CD 



O.CJ 



CO 

3 

CO 
CD 
DC 

CD 

a 



Egg 

CN CN 



Q CO 

°£H2 



CJ> 



o 



o 



I HI 

£3 



O- 



l_ <D 



CN 

cr> 

crj 
CN 



O 
cn 



0 



CN 

O 
CN 



o 



X 



o 



CD 



O 

en 



-Q 



O 




.13 



£3 

l— C CN <— 5 

« o to co 

CD r- «... 
CO CO i 



O 



Q_ 
CD 



E 
-a 



CD 



CD 



CD 



o 

=3 



-a 



o 



CO 



CD 

en 

CD 

"3 

s 

Q_ 



REPLACEMENT SHEET 
Title: Method and System for Displaying Network Security Incidents 
Appl.No.: 10/661,224 Docket No. 50325-1085 




CO 

EC 



